We have captured using an old Netgear GA511 for many years. Using Netoptics taps, we capture to both the laptop onboard NIC and the GA511. We occasionally experience minor timestamp differences between them, but nothing we can't deal with. We were never sure if it was due to the NICs or the two instances of Wireshark that were running. With the advantages of 1.8, we are re-visiting our configuration, and are interested in the possibility of a dual-NIC PC card. Long ago, there was a list of compatible/recommended NICs on the Wireshark (or maybe Ethereal or WinpCap) site. I can't seem to find any such list. Is there a list any more? Do all NICs support promiscuous mode now? Any recommendations for dual-NIC PC cards from the field? Any known problems? asked 05 Oct '12, 11:48  bmcmanus |
One Answer:
As far as I know, there is no official list of recommended NICs, neither for Wireshark nor for WinPcap. Both systems are built to work (basically) with every ethernet adapter (and others). However, we all know there are several issues with NIC drivers (Offloading, TCP Chimney, etc.) that make it hard to choose the right one. Even worse, with every driver update problems can shift (one problem fixed, two new added ;-)). So, basically, you can just rely on the "recommendation" of people who actually have used one specific adapter. Let's see which NICs will be named here. I would name the Intel PRO/1000 PT Dual Port Server Adapter. Maybe you want to take a look a TurboCap, a dual/quad port NIC especially built for packet capturing.
Regards answered 08 Oct '12, 11:06  Kurt Knochner ♦ |
Kurt - Thanks for the info. The turbocap looks like a great device. We are looking for PC card dual NICs for our analysis laptops, however. Any suggestions from users with those devices?
Oops, I did not see the "PC card" part.
I know only one ExpressCard with a dual port nic:
No experience at all with that card!
I doubt, that there is any dual port nic with a "PC card" interface.
Maybe it's time for better/new equipment ;-))